mod_shield next-gen HTTP DoS protection. Early testing!

Extensions + Customization
, ,
5

2.999.202506091451 adds support for negative baseline scoring to DOSDeadlinePenalty.

# Negate any static requests...
DOSDeadlinePenalty 0 -1
# ... that completes within 50 ms
DOSDeadlinePenalty 0.05 0
# Add a point for each response that takes longer than 1.5s
DOSDeadlinePenalty 1.5 1

It’s also possible to clear the curve in /etc/httpd/conf.d/shield.conf by setting “off”:

# Clear everything
DOSDeadlinePenalty off
DOSDeadlinePenalty 1 5
DOSDeadlinePenalty 5 15

With adjustments, the curve now reads: requests < 1000 ms score 0, 1000 ms <= request < 5000 ms scores 5, and request > 5000 ms scores 15.

If you’d like to check requests - for curve fitting - setup a custom log profile in httpd-custom.conf:

LogFormat "%{ms}T %h %V %{SITE_ID}e %t \"%r\" %>s %b" monitor

Then to log for each site of interest, add to /etc/httpd/conf/siteXX/timing-log:

CustomLog /var/log/httpd/site-timings monitor

Run htrebuild to recompile Apache configuration.